Import CSV and update multi value field


I'm importing large CSV files into elasticsearch using logstash. I'm prefixing specific values like this:

    filter {      
       if [path] =~ "xyz" {
         csv {
              separator => ";"
             columns =>

           if [IOT]{
           mutate {
              update => { "IOT" => "v-%{IOT}" }

Recently we discovered multi values fields in those files and now I want to add the prefix to each value in the field.


 1;Mueller;Hans;42553;1;['9', '12', '13', '14']
 2;Meier;Peter;42873;2;['8', '14']

Right now those lines are beeing read like v-['8', '14'].

The output I need is something like [v-8, v-14].

Is there a way to achieve this in the logstash config? Maybe something like for each statement?

Also not sure if the multi value syntax in the csv is correct.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.